JPH08249197A - Cpu abnormality monitor system - Google Patents

Abstract

PURPOSE: To monitor the operation state of CPU by means of TPU (intelligent timer) in ECU so as to execute a precise fail safe operation when CPU is abnormal. CONSTITUTION: An execution part 42 in TPU 40 interrupts CPU 30a, and increases a counter for abnormality detection. When the counter for abnormality detection is not reset by CPU 30a even if prescribed time passes, a CPU abnormality detection part 45 judges CPU 30a to be in an abnormal state, outputs a fail signal for becoming a fail mode from a fail signal output part 46 to a CPU 30a-side and detaches it from a common bus 30e. Thus, the execution part 42 of TPU 40 can execute the precise fail safe operation even if CPU is abnormal by using an A/D converter 30p, an input port 30g and an output port 30h being the other specified modules, which are connected to the common bus 30e.

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a CPU abnormality monitoring system for monitoring the operating state of a CPU by an intelligent timer in a microcomputer for controlling an internal combustion engine and fail-safe in case of CPU abnormality.

[0002]

2. Description of the Related Art Conventionally, an internal combustion engine is controlled by a microcomputer, and when a microcomputer CPU abnormality (such as program runaway) is detected by a monitoring system including a monitoring circuit, safe driving is given the highest priority. As a backup mode, there is known a technique of controlling fuel injection, ignition timing, valve output and the like by using the minimum necessary inputs (rotation angle sensor input, throttle position sensor input, etc.).

As a prior art document related to the CPU abnormality monitoring system, the one disclosed in Japanese Patent Publication No. 62-9934 is known. This document discloses a technique in which two microcomputers are used, and when one microcomputer becomes abnormal, the other microcomputer backs up.

Further, in recent years, in order to reduce the calculation load of the CPU (central processing unit) in the microcomputer, a TPU (intelligent timer) is provided separately from the CPU to control the internal combustion engine. There is.
Here, the TPU is a timer having a management function of outputting a desired signal when a predetermined time is reached, and more specifically, for example, the fuel injection start timing, the fuel injection time, etc. obtained by the calculation of the CPU are Parameter RAM
Then, the subsequent injection execution process, that is, the process of executing the fuel injection at the predetermined rotation angle position for the predetermined time can be independently performed without the intervention of the CPU.

[0005]

By the way, in a backup system in which a microcomputer attempts to perform a fail-safe operation when the CPU operation is abnormal, generally,
The functions that can be fail-safe are limited to, for example, a preset fuel injection amount, ignition timing, and all valve output OFF.

On the other hand, if a plurality of microcomputers are used and one of the microcomputers has a CPU operation abnormality and the other microcomputer backs up, a higher-performance fail-safe operation is possible. However, there has been a problem that the demand for miniaturization and cost reduction cannot be met due to the complicated circuit configuration.

Further, when the CPU operation is abnormal, the parameter RAM inside the TPU is not updated, so that the TPU can only perform processing in synchronization with the rotation angle signal, that is, at which number of rotation angle signal the fuel injection is started. For,
Conventionally, the control executed via the CPU, for example, the asynchronous injection in which the fuel is injected at the timing not synchronized with the rotation angle signal cannot be executed, which is not practical.

Therefore, the present invention has been made to solve the above problems, and the operating state of the CPU is monitored by the TPU in the microcomputer for controlling the internal combustion engine, and an appropriate fail-safe operation can be performed when the CPU is abnormal. The problem is to provide a simple CPU abnormality monitoring system.

[0009]

A CPU according to claim 1
The abnormality monitoring system is a CPU in a microcomputer.
An abnormality determining means for monitoring the operating state of the CPU and determining an abnormality thereof, and a connection separating means for disconnecting at least the CPU from the connected internal bus line when the abnormality determining means determines that the CPU has an operation abnormality. After disconnecting the CPU by the connection / separation means, an abnormal time processing means for operating a specific module in the microcomputer for fail-safe operation is provided.

According to a second aspect of the present invention, in addition to the means of the first aspect, the CPU abnormality monitoring system further comprises a parameter storage means for storing the A / D value of a predetermined parameter at a specific address.

According to a third aspect of the CPU abnormality monitoring system, in addition to the means provided in the first or second aspect,
When the abnormality determining means does not determine that the CPU is operating abnormally, the CPU is provided with a signal transmitting means for transmitting a control signal set by the CPU at every predetermined timing.

[0012]

In the CPU abnormality monitoring system according to the first aspect, the abnormality determining means monitors the operating state of the CPU in the microcomputer, and when it is determined that the CPU is in an abnormal operation, at least the CPU is connected by the connection separating means. After disconnecting from the internal bus line, the specific module in the microcomputer is operated by the abnormal time processing means to perform fail safe. Therefore, the CPU
Even after being determined to be abnormal in operation and being disconnected from the internal bus line, the other specific modules connected to the internal bus line can operate.

In the CPU abnormality monitoring system according to claim 2,
In addition to the effect of the first aspect, the A / D value of the predetermined parameter is stored in the specific address of the parameter storage means. That is, the A / D value of the predetermined parameter is stored in the specific address of the parameter storage means regardless of the normal / abnormal operation state of the CPU.

In the CPU abnormality monitoring system of claim 3,
In addition to the operation of claim 1 or claim 2, when the CPU is not determined to be in an abnormal operation, that is, when the operating state of the CPU is normal, the control signal set by the CPU is transmitted via the signal transmission means. Are transmitted at predetermined timing.

[0015]

EXAMPLES The present invention will be described below based on specific examples.

FIG. 1 is a block diagram showing a CPU abnormality monitoring system according to an embodiment of the present invention.

In FIG. 1, reference numeral 1 denotes an internal combustion engine. The internal combustion engine 1 forms a combustion chamber 5 from a cylinder 2, a piston 3 and a cylinder head 4, and a spark plug 6 is arranged in the combustion chamber 5. .

The intake system of the internal combustion engine 1 includes an intake manifold 8 communicating with the combustion chamber 5 through an intake valve 7, an injector 9 for injecting fuel into the intake manifold 8, and an intake pipe 10 communicating with the intake manifold 8.
It is composed of a surge tank 11 for absorbing the pulsation of intake air, a throttle valve 12, and an air cleaner 13. The exhaust system of the internal combustion engine 1 is composed of an exhaust manifold 15 which communicates with the combustion chamber 5 via an exhaust valve 14.

An igniter 16 for outputting a high voltage required for ignition is provided to the internal combustion engine 1, and a distributor for supplying the high voltage generated by the igniter 16 in conjunction with a crankshaft (not shown) to the ignition plugs 6 of the respective cylinders. 17,
ISC (IdleSp) that controls intake air by bypassing the throttle valve 12 during idling
A valve 18 is provided.

Further, in the internal combustion engine 1, a water temperature sensor 20 provided in the cooling system of the internal combustion engine 1 as various sensors to detect the cooling water temperature, and an intake air temperature sent to the internal combustion engine 1 provided in the air cleaner 13 are detected. Intake temperature sensor 2
1. A throttle position sensor 22 that detects the throttle opening of the throttle valve 12 in conjunction with the throttle valve 12, an intake pressure sensor 23 that communicates with the intake pipe 10 to detect the pressure in the intake pipe, and an exhaust gas provided in the exhaust manifold 15. Oxygen sensor 24 for detecting the residual oxygen (O ₂ ) concentration therein as an analog signal, mounted in the distributor 17 every 1/24 revolutions of the cam shaft of the distributor 17, that is, from 0 ° CA (crank angle) to 30 ° CA A rotation angle sensor 25 that also functions as a rotation speed sensor that detects a rotation angle signal for each integral multiple of, and a warning lamp 26 that warns a driver or the like of an abnormal state of the internal combustion engine 1 are provided.

Each signal detected by the above various sensors is sent to an ECU (Electronic Con
control unit: electronic control unit) 30 and ECU 30
Is an injector 9 and an igniter 16 based on each signal.
To control the internal combustion engine 1.

Next, the detailed structure of the ECU 30 will be described with reference to FIG.

The ECU 30 mainly inputs and calculates each signal detected by the above-mentioned various sensors according to a control program, and executes a calculation process for controlling the above-mentioned various devices, a CPU 30a, a control program and initial data. The ROM 30b to be stored in advance, the RAM 30c to temporarily store each input signal and data necessary for arithmetic control, and the key switch (not shown) of the internal combustion engine 1 are backed up by the battery power even if the driver turns off. Backup RAM 30d and TP capable of storing and holding various data necessary for controlling the internal combustion engine 1
It is configured as a logical operation circuit centered on U40 and performs input / output with various devices connected to the input port 30g and the output port 30h via the common bus 30e which is an internal bus.

The ECU 30 includes the intake pressure sensor 23,
Buffers 30i, 3 for output signals from the water temperature sensor 20, the intake air temperature sensor 21, and the throttle position sensor 22
0j, 30k, 30m are provided, and the buffer 30
i, 30j, 30k and 30m are connected to an A / D converter 30p which converts an analog signal into a digital signal. These signals are sent to the CPU 3 via the common bus 30e.
It is input to 0a.

Further, the ECU 30 is provided with the oxygen sensor 2
4 is provided with a buffer 30q for the output signal of No. 4, and a comparator 30r for outputting a signal when the output voltage of the buffer 30q becomes a predetermined voltage abnormality.
Signal is input to the CPU 30a via the input port 30g.

The ECU 30 has a waveform shaping circuit 30s for shaping the waveform of the output signal of the rotation angle sensor 25.
Is provided, the rotation angle signal from the rotation angle sensor 25 is input to the TPU 40, and CP is supplied via the common bus 30e.
It is input to U30a.

Further, the ECU 30 is provided with drive circuits 30t and 30u for supplying a drive current to the warning lamp 26 and the igniter 16, respectively.
a is each drive circuit 30t, 30 through the output port 30h.
Output a control signal to u.

On the other hand, the control amounts such as the fuel injection time and the injection start timing calculated and calculated by the CPU 30a based on the information from the various sensors described above are set in the TPU 40, and the TPU 40 controls the control timing according to the control amount. Then, the control signal is output to the drive circuit 30w to drive the injector 9.

The ECU 30 has CPUs 30a, T
There is also provided a clock circuit 30v for sending a clock signal, which becomes control timing, to the PU 40, the ROM 30b, the RAM 30c and the like at predetermined intervals.

In addition, the fail line 30y is connected in the ECU 30 as shown in FIG. 2, and when the abnormality monitoring routine in the TPU 40 determines that the movement of the CPU 30a is abnormal, the TPU 40 uses the fail line 30y to perform C
PU 30a, ROM 30b, RAM 30c, backup RAM 30d, A / D converter 30p, input port 30
g, a fail signal is output to the output port 30h to switch to a preset backup mode.

The reset line 3 is provided in the ECU 30.
0x is connected as shown in FIG. 2, and when it is determined that the internal combustion engine 1 enters a low load operation state by the fail signal from the fail line 30y and the ECU 30 may be reset as a whole, the TPU 40 is reset. Line 3
CPU 30a, ROM 30b, RAM 30 using 0x
c, backup RAM 30d, A / D converter 30p,
A reset signal is issued to the input port 30g and the output port 30h.

FIG. 3 is a block diagram showing the internal structure of the TPU 40.

In FIG. 3, the TPU 40 includes a scheduler 41, an execution unit 42, a control storage unit 43, and an FRC (Free R).
An uncounter (free run counter) 44, a CPU abnormality detection unit 45, a fail signal output unit 46, a reset signal output unit 47, and a timer channel unit 48.

The scheduler 41 is for instructing the execution unit 42 to perform each process such as calculation and data setting according to the priority order assigned to each channel of the timer channel unit 48, and the execution unit 42 is specified. The arithmetic processing of the channel is executed based on various processing routines stored in advance in the control storage unit 43. The FRC 44 is a counter that is incremented by the clock signal CK from the clock circuit 30v, and this count-up process is executed by the execution unit 42.

Then, the CPU abnormality detecting section 45 is
0a to the parameter R of the timer channel unit 48 described later.
It is detected whether or not a read (read) or a write (write) operation is performed on the AM 50 and the control register 54 at regular intervals. Here, when nothing is done within a predetermined time, the CPU abnormality detection unit 45 determines that the CPU operation is abnormal, and the fail signal output unit 46 is notified to the timer channel unit 48, the CPU 30a, the ROM 30b, the RAM 30c, and the CPU 30a.
It instructs the backup RAM 30d, the A / D converter 30p, the input port 30g, and the output port 30h to output a fail signal. In addition, the CPU abnormality detection unit 45 instructs the execution unit 42 to perform control for fail-safe operation. This CPU abnormality detection is individually set by the function defined in the timer channel section 48.

The reset signal output unit 47 determines that the internal combustion engine 1 is in the low-load operating state by the execution unit 42 executing the fail-safe operation by the fail signal output from the CPU abnormality detection unit 45, and then the execution unit 42, CPU 30a, ROM 30b, RAM 30
c, backup RAM 30d, A / D converter 30p,
A reset signal is output to the input port 30g and the output port 30h.

The timer channel section 48 uses the parameter RA
M50, compare register 51, capture register 5
2 and input / output pin control 53, and these units are provided by the number of input / output pins of the TPU 40.
In this embodiment, since there are 16 input / output pins in total, 16 parameter RAMs 50 are provided, and
Similarly, 16 control registers 54 for controlling the functions defined in the timer channel section 48 are provided.

Further, in this embodiment, the timer channel unit 4
In FIG. 8, a portion consisting of one parameter RAM 50, a compare register 51, a capture register 52, and an input / output pin control 53 is called a channel. In this embodiment, as described above, the total number of 16 input / output pins is 0. All 16 channels up to 15 are provided.

The waveform shaping circuit 3 is provided for channel 0.
The rotation angle signal C0 is input via 0s, and injector # 1 and # 2 signals C1 and C2 for driving the injector 9 are output from channels 1 and 2.
Further, an ISC signal C3 for driving the ISC valve 18 is output from the third channel, and a valve signal C4 is output from the fourth channel. Further, various signals for controlling the internal combustion engine 1 and various devices of the vehicle are also input / output to / from other channels, but since they are not directly related to the gist of the present embodiment, their description will be omitted.

The parameter RAM 50 is a dual-port RAM that can be accessed by both the CPU 30a and the execution unit 42 when the CPU 30a is normal, and C
Data is exchanged between the PU 30a and the TPU 40. Further, when the CPU 30a is abnormal, it is used as a storage device in the control of the TPU 40. This is CPU30
In case of abnormality of a, ROM 30b, RA in addition to CPU 30a
M30c, backup RAM 30d, and common bus 3
This is because the connection with 0e is disconnected. The compare register 51 is a register for comparing the contents of this register with the contents of the FRC 44, and the contents of the compare register 51 are F
A signal is output to the input / output pin control 53 so as to output a high level signal or a low level signal when the contents of the RC 44 are equal to or greater than (matched with). The execution unit 42 sets whether to output the high level signal or the low level signal.

The capture register 52 detects the rising edge or falling edge of the signal (rotation angle signal, etc.) input to the input / output pin control 53, and F at this time is detected.
This is a register for holding the contents of RC44. As described above, the input / output pin control 53 outputs a desired signal set by the execution unit 42 when the contents of the compare register 51 and the contents of the FRC 44 match,
A signal from the outside of the TPU 40 is input.

Further, the TPU 40 has a compare register 5
1, or a switch unit (not shown) for switching the connection state between the capture register 52 and the FRC 44 is provided. This switch unit is also provided by the number of input / output pins of the TPU 40, and is controlled by a command from the execution unit 42.

FIG. 4 shows the scheduler 41 and the execution unit 4 described above.
2 is a block diagram showing the relationship between the control storage unit 43 and the FRC 44. FIG.

In FIG. 4, the control storage unit 43 has various programs as a pulse input (cycle measurement) processing routine, a duty pulse output processing routine, a valve output processing routine, a fail safe operation processing routine, and a fuel injection output. Processing routines and the like are stored in advance, and the execution unit 42 controls the timer channel unit 48 using these functions according to an instruction from the scheduler 41.

Next, a processing procedure in which the TPU 40 detects the abnormal operation of the CPU 30a and executes the fail-safe operation will be described with reference to FIGS. TPU40
Has a total of 16 input / output pins of 16 channels as described above. Of these, 0 channel will be described below as an example.

In order to record the period measurement value of the rotation angle signal C0 input via the waveform shaping circuit 30s, the input time of the pulse and the state of the terminal level at the time of input in the parameter RAM 50 for 0 channel shown in FIG. 6 (a) to 6
In the control register 54 shown in (e), first, the 0-channel control function setting area of the input / output function setting register 63 is defined as "1100" for pulse input in advance (see FIG. 6D). When there is a pulse input to channel 0 according to this setting, the execution unit 42 performs input processing using the pulse input processing routine stored in the control storage unit 43, and the calculated result is used as the parameter R
Record at AM50.

After the recording in the parameter RAM 50 is completed, an interrupt request can be issued to the CPU 30a. This is done by setting the interrupt permission flag of the 0-channel area of the flag register 60 in the control register 54 to "1" (see FIG. 6A). When an interrupt occurs, the corresponding bit in the status register 64 is set to "1"
The corresponding bit of is reset by writing "0" from the CPU 30a (see FIG. 6 (e)). In the present embodiment, the priority of the processing of channel 0 is high, and the area for channel 0 of the priority setting register 61 is "1".
1 "(see FIG. 6B). Since only the falling edge direction of the input pulse is used in this embodiment, the corresponding bit in the 0 channel area of the flag register 60 is" 0 ". Is set to "" (see FIG. 6A).

When the 0 channel set for pulse input is used, the parameter RAM 50 and the input / output pin control 53 are initialized. This process
This is performed by setting the area for channel 0 of the processing execution request register 62 to "01", and when this processing is completed, the area for channel 0 of the processing execution request register 62 is returned to "00" (FIG. 6C). reference).

The abnormality detection performed by the TPU 40 is shown in FIG.
In the priority setting register 61 shown in “00” (Disable:
CPU3 for all channels set to other than (Prohibited)
0a periodically checks whether the parameter RAM 50 or the control register 54 is accessed.

Next, the case of detecting an abnormal operation of channel 0 set for pulse input will be described below with reference to the time chart of FIG.

After the input processing, the execution unit 42 in the TPU 40 causes the CPU 30a to generate an interrupt, and the corresponding bit of the status register 64 in the control register 54 of the timer channel unit 48 is set to "1". Is "1", the execution unit 42 counts the error detection counter prepared for each channel. Then, even if a predetermined time has elapsed, the abnormality detection counter is
If it is not reset to “0” by 0a (exceeds the abnormality determination level), the CPU abnormality detection unit 45 determines that the CPU 30
It is determined that a is in an abnormal state, and the fail signal output unit 46 is requested to output a fail signal to enter the fail mode. When the relevant bit of the status register 64 in the control register 54 becomes "0", the execution unit 42 resets the abnormality detection counter.

FIG. 8 is a flow chart showing the operation procedure until the abnormality detection of the TPU 40. The execution unit 42 of the TPU 40 checks the access status to all the channels set by the CPU 30a out of all 16 channels. Here, the access check to the 0 channel will be described as an example.

The execution unit 42 starts execution of the 0-channel processing according to an instruction from the scheduler 41. First, in step S101, it is determined whether or not there is a falling edge input set by the input edge direction setting flag of the flag register 60. When the determination condition of step S101 is satisfied, the process proceeds to step S102, and the cycle measurement value, the pulse input time, and the terminal level at the time of input are checked,
A series of pulse input processing recorded in the parameter RAM 50 is executed. Next, in step S103,
An interrupt is generated for the CPU 30a to notify that the CPU 30a has completed the pulse input processing, and the bit of the 0 channel area of the status register 64 is set to "1" at the time of the interrupt. On the other hand, if the determination condition of step S101 is not satisfied, step S
102 and step S103 are skipped.

Next, in step S104, it is determined whether the bit in the 0 channel area of the status register 64 is "1". If the determination condition of step S104 is not satisfied and is “0”, step S105
Then, after the abnormality detecting counter for detecting an abnormality in accessing the 0th channel of the CPU 30a is cleared to "0", this routine is ended. On the other hand, step S10
When the determination condition of 4 is satisfied, the process proceeds to step S106, and the abnormality detection counter for detecting the access abnormality of the 0 channel of the CPU 30a is incremented by "1".

Then, the process proceeds to step S107, where the CPU
It is determined whether or not the value of the abnormality detection counter for detecting the abnormality in access to channel 0 of 30a is greater than or equal to a predetermined value. When the determination condition of step S107 is not satisfied, this routine is ended. On the other hand, when the determination condition of step S107 is satisfied, the CPU 30a is in an abnormal state, the process proceeds to step S108, and the fail signal output unit 46 is instructed to output the fail signal, and at the same time, the execution unit 42 in the control storage unit 43. Fail-safe processing is executed, that is, the CPU 30a and the ROM 30 in the ECU 30
b, RAM 30c, backup RAM 30d, A / D
After changing the converter 30p, the input port 30g, the output port 30h, and the TPU 40 from the normal operation to the fail-safe operation, this routine is ended.

Next, a description will be given based on the flow chart of FIG. 9 showing a fail-safe operation procedure after the abnormality of the TPU 40 is detected and a predetermined operating state is output and a reset signal is output to return the operation of the ECU 30 to the normal operation.

In step S108 of FIG. 8 described above, the CPU 3
When the abnormal state of 0a is detected, the fail-safe operation is started. First, in step S201, the C
The PU 30a, the ROM 30b, the RAM 30c, the backup RAM 30d, and the common bus 30e are disconnected from each other, and are not connected again until a reset signal is issued. Thus, the operation of the common bus 30e is T
The execution unit 42 of the PU 40 can be managed. Next, the process proceeds to step S202, and all the A / D converters 30p are periodically (for example, every 8 ms) all A during fail-safe operation.
Switch to continuous mode for A / D conversion of / D channel input. The conversion resolution is A / when the CPU 30a is normal.
The parameters set for the D converter 30p are applied so that the accuracy similar to that in the normal state can be obtained even in the fail-safe operation.

Next, in step S203, since the input port 30g does not have to be used for the fail-safe operation this time, it is disconnected from the common bus 30e when the fail signal is output. Here, depending on the application, the fail-safe operation may be performed while the input port 30g is connected to the common bus 30e.

Next, in step S204, the output port 30h and the TPU 40 are switched to the preset operation mode when the CPU 30a is normal. The fail-safe operation of each of these modules is not operated by the execution unit 42, but each module performs input or output at predetermined time intervals, and the execution unit 42 executes the fail-safe operation of the control storage unit 43 in step S205. According to the processing procedure, the parameter RAM 50 is used as a storage device, and calculation values (fuel injection amount, ignition timing, I
Various devices are controlled by the output signal based on the SC-Duty value or the like). The fail-safe operation is the input A
Linear output control is performed by parameters such as / D value and engine speed.

Next, the routine proceeds to step S206, where it is judged if a preset operating state suitable for resetting has been reached. This determination condition is determined by whether the A / D value or the engine speed is in a low load operating state or in an idle state. This is because if the CPU 30a is reset when the internal combustion engine is in a high load state, the load fluctuation during the calculation of the CPU 30a becomes large and a shock occurs. When the determination condition of step S206 is not satisfied, this routine ends. On the other hand, when the determination condition of step S206 is satisfied, the process proceeds to step S207, and the execution unit 42 instructs the reset signal output unit 47 to EC.
All the modules of U30 are requested to issue the reset signal, and the reset signal output unit 47 outputs the reset signal accordingly. Next, in step S208,
After each module receives the reset signal, the fail mode is released, the ECU 30 is returned to the normal operation, and this routine ends.

Next, FIG. 10 shows T during the processing of FIG.
It is a flowchart which shows the fuel injection control at the time of fail safe operation of PU40. Although only the fuel injection control will be described in the present embodiment, the ignition timing control and the like are also performed by the TPU4.
0 does.

In step S301, it is determined whether there is a fail signal. When the determination condition of step S301 is not satisfied, this routine ends. On the other hand, when the determination condition of step S301 is satisfied, step S3
After 02, in the fail-safe operation, the fuel injection control is performed using the function set for the fuel injection control of the 1st channel and the 2nd channel in the failsafe process.
First, the engine speed obtained from the A / D values of the battery voltage, the intake pressure, and the cooling water temperature that are A / D converted by the A / D converter 30p in step S302 and the cycle measurement value of the 0 channel of the TPU 40 are used. Then, the basic fuel injection amount is calculated. Note that when the CPU 30a is normal, various fuel injection correction calculations such as post-start correction and acceleration correction are executed, but unlike fuel injection control under fail-safe operation, many correction calculations are not performed unlike during normal operation.

At this time, in step S303, the A / D value of the throttle opening is checked to determine whether the throttle is fully closed (A / D value = minimum value). When the determination condition of step S303 is satisfied, step S
After shifting to 304 and executing fuel cut control, this routine is ended. On the other hand, when the determination condition of step S303 is not satisfied, the process proceeds to step S305,
It is determined whether the throttle is fully open (A / D value = maximum value). When the determination condition of step S305 is satisfied, the process proceeds to step S306, and the multiplication correction process is performed so that the fuel injection amount calculated in step S302 is increased using the increase coefficient set in advance according to the engine speed. It On the other hand, when the determination condition of step S305 is not satisfied, the process proceeds to step S307, and the weight reduction coefficient set in advance according to the engine speed is used to perform step S302.
Multiplication correction processing is performed so that the fuel injection amount calculated in step 1 is reduced. The above step S306 or step S3
After the process of 07, the process proceeds to step S308, the fuel injection based on the final fuel injection amount is executed by the injector 9, and this routine ends.

In this way, the CPU abnormality monitoring system of this embodiment is achieved by the execution unit 42 and the CPU abnormality detection unit 45 of the TPU 40 that monitors the operating state of the CPU 30a in the ECU 30 as a microcomputer and determines the abnormality. Abnormality determination means, and the abnormality determination means include a CPU
When it is determined that 30a is malfunctioning, at least C
The connection separation means achieved by the fail signal output unit 46 of the TPU 40 that disconnects the PU 30a from the common bus 30e that is the connected internal bus line, and the CPU 30a that is separated by the connection separation means, and then the specific module in the ECU 30. The A / D converter 30p, the input port 30g, and the output port 30h are operated as an abnormal condition processing unit achieved by the execution unit 42 of the TPU 40 that performs fail-safe. It can be one example.

Therefore, the abnormality determining means achieved by the executing unit 42 and the CPU abnormality detecting unit 45 of the TPU 40 makes E
When the operating state of the CPU 30a in the CU 30 is monitored and it is determined that the CPU 30a is in an abnormal operation, the TPU
After disconnecting at least the CPU 30a from the connected common bus 30e by the connection separation means achieved by the fail signal output unit 46 of the ECU 40, the ECU 30 is executed by the abnormality processing means achieved by the execution unit 42 of the TPU 40. The A / D converter 30p, the input port 30g, and the output port 30h are operated to perform fail-safe.

Therefore, the CPU 30a in the ECU 30 is determined to be in an abnormal operation, and the common bus 3 as an internal bus line is detected.
Common bus 30e even after being disconnected from 0e
A / as other specific module connected to
D converter 30p, input port 30g and output port 30
h is operable, and an accurate fail-safe operation can be performed by using an input / output signal from the specific module.

Further, the CPU abnormality monitoring system of the present embodiment comprises a parameter RAM 50 for storing an A / D value of a predetermined parameter at a specific address, in addition to the abnormality judging means, the connection separating means and the abnormality processing means. It is provided with a parameter storage means, which can be an embodiment of claim 2.

Therefore, the A / D value of the predetermined parameter is stored in the specific address of the parameter RAM 50 regardless of whether the operating state of the CPU 30a is normal or abnormal. Therefore, the transition of the predetermined parameter can be constantly reflected in the control.

Further, the CPU abnormality monitoring system of the present embodiment further causes the CPU 30a to notify the CPU 30a when the abnormality determining means achieved by the executing section 42 and the CPU abnormality detecting section 45 of the TPU 40 does not determine that the CPU 30a is in the abnormal operation state. The TPU 40 is provided with a signal transmitting means for transmitting the control signal set by the above-mentioned method at every predetermined timing. This can be an embodiment of claim 3.

Therefore, when the CPU 30a is operating normally, the control signals such as the fuel injection time and the injection start timing calculated and set by the CPU 30a are transmitted to the TPU 40.
Is sent at every predetermined timing. Therefore, C
When the PU 30a operates normally, the TPU 40 operates as the CPU 3
It operates to assist the control of 0a.

[0071]

As described above, the CPU according to claim 1
According to the abnormality monitoring system, the operation state of the CPU in the microcomputer is monitored by the abnormality determining means, and the CP
When U is determined to be in an abnormal operation, the connection / separation means disconnects from at least the internal bus line to which the CPU is connected, and then the abnormal time processing means activates a specific module in the microcomputer to provide fail safe. Done. As a result, even after the CPU is determined to be operating abnormally and disconnected from the internal bus line, the other specific modules connected to the internal bus line can operate and input / output signals from the specific module can be transmitted. An accurate fail-safe operation can be performed by using this.

According to the CPU abnormality monitoring system of the second aspect, in addition to the effect of the first aspect, the A / D value of the predetermined parameter is stored in the specific address of the parameter storage means.
As a result, the transition of the predetermined parameter can always be reflected in the control regardless of whether the operating state of the CPU is normal or abnormal.

According to the CPU abnormality monitoring system of claim 3, in addition to the effect of claim 1 or claim 2, when the CPU is not judged to be in an operation abnormality, a control signal set by the CPU is sent out. It can be sent out at every predetermined timing via the means. As a result, when the operating state of the CPU is normal, the CPU can be assisted, and when the operating state of the CPU becomes abnormal, control can be performed on behalf of the CPU.

[Brief description of drawings]

FIG. 1 is a configuration diagram showing a CPU abnormality monitoring system according to an embodiment of the present invention.

FIG. 2 is a block diagram showing a configuration of an ECU in the CPU abnormality monitoring system according to the embodiment of the present invention.

FIG. 3 is a block diagram showing a configuration of a TPU in the CPU abnormality monitoring system according to the embodiment of the present invention.

FIG. 4 is a block diagram showing details of a control storage unit in FIG.

FIG. 5 is a parameter RA for channel 0 of FIG.
It is a block diagram which shows the structure of M.

FIG. 6 is a block diagram showing a detailed configuration of the control register of FIG.

FIG. 7 is a time chart showing a signal state of channel 0 set for pulse input in the CPU abnormality monitoring system according to the embodiment of the present invention.

FIG. 8 is a flowchart showing a processing procedure at the time of detecting an abnormal operation of the TPU used in the CPU abnormality monitoring system according to the embodiment of the present invention.

FIG. 9 is a flowchart showing a processing procedure after detecting an abnormal operation of the TPU used in the CPU abnormality monitoring system according to the embodiment of the present invention.

FIG. 10 is a CPU according to an embodiment of the present invention.
It is a flow chart which shows a processing procedure at the time of fail-safe operation of TPU used by an abnormality monitoring system.

[Explanation of symbols]

 1 Internal Combustion Engine 9 Injector 25 Rotation Angle Sensor 30 ECU 30a CPU 40 TPU 42 Execution Section 44 FRC 45 CPU Abnormality Detection Section 47 Reset Signal Output Section 48 Timer Channel Section 50 Parameter RAM 54 Control Register

Claims (3)

[Claims] 1. An abnormality determining means for monitoring an operating state of a CPU in a microcomputer and determining an abnormality thereof, and when the abnormality determining means determines that the CPU is in an abnormal operation, at least the CPU is connected. A disconnection means for disconnecting the internal bus line from the internal bus line; and an abnormal condition processing means for performing a fail safe by operating a specific module in the microcomputer after disconnecting the CPU by the connection and separation means. Characteristic CPU abnormality monitoring system. 2. The CPU abnormality monitoring system according to claim 1, further comprising parameter storage means for storing an A / D value of a predetermined parameter at a specific address. 3. The CPU according to claim 1 or 2.
The abnormality monitoring system further comprises signal transmission means for transmitting a control signal set by the CPU at a predetermined timing when the abnormality determination means does not determine that the CPU is operating abnormally. CPU error monitoring system.